Skip to main content
August 10, 2026 Documentation correction Action required

​
Affects

Teams deploying or operating the SPI service for Pix operations in any environment, including development and production.

​
What changed

The documentation now correctly states that two values protecting operations PII are mandatory in every environment:
  • SPI_OPERATIONS_PII_ENCRYPTION_KEY must be a valid AES-256 key.
  • SPI_OPERATIONS_BLIND_INDEX_PEPPER must contain at least 32 characters.
The SPI service refuses to start when either value is missing, malformed, or too short. This is a documentation correction; runtime behavior did not change.

​
Impact

Classification: Action required. The prior wording did not make the startup requirement explicit. A deployment that omits either value, or supplies an invalid value, cannot start the SPI service.

​
What you need to do

1
Before the next SPI start or redeployment, provide both values through your secret manager in every environment.
2
Verify that the encryption key is a valid AES-256 key and that the blind-index pepper contains at least 32 characters.
3
Do not commit or log either value. Plan a re-index or re-encryption before rotating a pepper or key.

​
Deadline

No product-imposed deadline. Complete this validation before your next SPI start or redeployment.

​
Resources